AI is finding thousands of Linux kernel bugs, and maintainers can barely keep up

AI code review tools have driven the number of CVEs fixed per Linux kernel release from roughly 500 through much of the 6.x era to nearly 2,000 in the latest 7.x releases. Maintainers are drowning in reports, and the community is scrambling to build scalable triage workflows before the volume gets worse.

AI tools are finding bugs faster than maintainers can triage

Linux kernel maintainer Greg Kroah-Hartman shared data at the upcoming Kernel Recipes 2026 event showing that between versions 6.9 and 6.19, security researchers spotted around 500 CVEs per release on average. From Linux 7.0 onward that number jumped to roughly 1,000, and Linux 7.2 pushed past 1,500, with projections above 2,000 for Linux 7.3 as AI models improve TechSpot Tom's Hardware.

Most of the newly reported bugs were caught by AI code review platforms and large language models, including Z.ai's GLM-5.3 which alone found over 1,000 critical vulnerabilities across open source projects. The kernel's source tree is roughly 40 million lines of code, suggesting thousands more CVEs are waiting to be discovered.

Linus Torvalds warned in his Linux 7.1-rc4 release post that the kernel's private security mailing list had become "almost entirely unmanageable." Kernel maintainers report report volume climbed from 2-3 per week two years ago to 5-10 every day in 2026.

The real bottleneck is triage, not discovery

The headline numbers sound alarming, but most documented CVEs are low priority or affect obsolete drivers and deprecated features. The real problem is the triage pipeline: maintainers must review each report, assess severity, and decide whether to patch or close. When a large language model surfaces hundreds of bugs in legacy code, the human cost of verifying each one scales with the volume.

Kernel maintainers have described being "completely overwhelmed" by the sheer number of AI-generated reports. The issue isn't that the reports are fake, it's that thousands of people are using similar tools to find the same bugs, creating duplication and noise Panstag.

What this means for teams running Linux in production

If you ship products or infrastructure on Linux, expect the patching cadence to accelerate. Each kernel release now carries significantly more CVEs, and while many are low risk, the ones that matter will arrive faster. Teams should invest in automated vulnerability prioritization and patch management tooling, not just rely on manual triage.

There is also a silver lining. The flood of AI-detected bugs prompted maintainers to clean out old drivers and the entire ISDN subsystem earlier this year, removing dozens of CVEs at once. AI is forcing a long overdue spring cleaning of the kernel codebase.

Caveats and open questions

The CVE counts come from Greg Kroah-Hartman's slide and may not reflect every release's final numbers. The vast majority of AI-detected bugs affect obscure or deprecated code paths, not core kernel functionality. Whether the Linux Foundation's new industry response team can handle the growing volume remains to be seen. And as AI models become more capable, the trend lines point only upward.